Extracted

Extracted

• • Target

    864ee6a5eb1720e3f99cf33ad0253c21f911602300927b561c6cc871a913249d.exe

  • Size

    658KB

  • MD5

    21d3a84240f99db2ccf70a6aa22dfdc5

  • SHA1

    5b0f7c85444d3b388568a9f172211855adea14d7

  • SHA256

    864ee6a5eb1720e3f99cf33ad0253c21f911602300927b561c6cc871a913249d

  • SHA512

    d89a13804a38e09b65eb62ecaf8d4b37e0e404d5da9a34628e6490360c0b7d8f5e36c6ec005987e8540e7fc8aec340b607972c371bdcf3d2f36dcd98e946a80a

  • SSDEEP

    12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hi:+Z1xuVVjfFoynPaVBUR8f+kN10EB0

  Score

  10^/10

  darkcometlatentbotasylumdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2